Handle owner state change in HTMLLinkElement::setCSSStyleSheet

Source/core/html/HTMLLinkElement.cpp

Index: Source/core/html/HTMLLinkElement.cpp
diff --git a/Source/core/html/HTMLLinkElement.cpp b/Source/core/html/HTMLLinkElement.cpp
index 39ef9a4c9d90a04bc0233e0076d1da4eb58a03a5..c3d871ca039cd564f23123bcbd1da419450b5499 100644
--- a/Source/core/html/HTMLLinkElement.cpp
+++ b/Source/core/html/HTMLLinkElement.cpp
@@ -518,7 +518,15 @@ void LinkStyle::setCSSStyleSheet(const String& href, const KURL& baseURL, const
         notifyLoadedSheetAndAllCriticalSubresources(Node::ErrorOccurredLoadingSubresource);
         return;
     }
-
+    // While the stylesheet is asynchronously loading, the owner can be moved under
+    // shadow tree.  In that case, cancel any processing on the loaded content.
+    if (m_owner->isInShadowTree()) {
+        m_loading = false;
+        removePendingSheet();
+        if (m_sheet)
+            clearSheet();
+        return;
+    }
     // Completing the sheet load may cause scripts to execute.
     RefPtrWillBeRawPtr<Node> protector(m_owner.get());